Posted in cybercrime/malcode, economics, finance, government | Leave a Comment on Mysterious Mastercard Data Breach Triggers Bank Warning As Customers Urged To ‘Pay Close Attention’ To Money Movements
A US bank is warning customers of a security “intrusion” that may have compromised Mastercard account numbers and other financial data.
Maryland-based Eagle Bank says it has received a notice from Mastercard, stating an unnamed US merchant allowed unauthorized access to account information between August 15th, 2023, and May 25th, 2024.
The bank revealed the breach in a filing with the Massachusetts state government.
Illustration: Liu Rui/GT
China on Monday released its third report on the “Volt Typhoon” investigation. The report not only provides critical new information but also delivers a clearer message to responsible stakeholders concerned with global cyberspace security and governance: A previously underappreciated threat must be taken seriously. This threat originates from US intelligence agencies and security bodies, which, possessing superior technological capabilities, engage in “false flag” operations — activities carried out to deliberately conceal the true origin of cyberattacks while falsely attributing responsibility to someone else, particularly an opponent. To serve their own interests, these organizations openly or tacitly collaborate with high-tech companies.
The Marble Framework mentioned in the latest investigative report was first exposed in 2017 when WikiLeaks claimed to have obtained information from inside the CIA’s Center for Cyber Intelligence. Developed by the CIA as an anti-forensics tool, the primary function of the Marble Framework is to obscure and disguise the true origins of cyberattacks, making it difficult to trace these attacks back to the actual perpetrators. The Marble Framework employs string obfuscation to hide textual information within the malware, as this text often provides forensic experts with clues to identify the developer or country of origin behind the malicious software.
U.S. government updates Traffic Light Protocol guidance to enhance cybersecurity information sharing and collaboration.
A researcher has released a tool to bypass Google’s new App-Bound encryption cookie-theft defenses and extract saved credentials from the Chrome web browser.
The tool, named ‘Chrome-App-Bound-Encryption-Decryption,’ was released by cybersecurity researcher Alexander Hagenah after he noticed that others were already figuring out similar bypasses.
Although the tool achieves what multiple infostealer operations have already added to their malware, its public availability raises the risk for Chrome users who continue to store sensitive data in their browsers.
Chinese botnet Storm-0940 exploits routers, targets Microsoft users with covert password spray attacks.
Discover how the new Xiū gǒu phishing kit threatens users in multiple countries since September 2024.
The Dstat.cc DDoS review platform has been seized by law enforcement, and two suspects have been arrested after the service helped fuel distributed denial-of-service attacks for years.
The seizure and arrests were conducted as part of “Operation PowerOFF,” an ongoing international law enforcement operation that targets DDoS-for-hire platforms, aka “booters” or “stressers,” to seize infrastructure and arrest the operators.
These platforms are responsible for service disruptions to online services and can cause significant economic damages, as well as impact to the operation of critical services, such as healthcare.
New CRON#TRAP malware installs a Linux VM backdoor on Windows, evading antivirus, and allowing hidden control over compromised systems.
Nokia’s investigation of recent claims of a data breach found that the source code leaked on a hacker forum belongs to a third party and company and customer data has not been impacted.
The statement comes in response to threat actor IntelBroker earlier this week releasing data belonging to Nokia, allegedly stolen after breaching a third-party vendor’s server.
The hacker tried to sell the data, claiming that it includes SSH keys, source code, RSA keys, BitBucket logins, SMTP accounts, webhooks, and hardcoded credentials, but they decided to leak it after Nokia denied the breach.
A new phishing campaign dubbed ‘CRON#TRAP’ infects Windows with a Linux virtual machine that contains a built-in backdoor to give stealthy access to corporate networks.
Using virtual machines to conduct attacks is nothing new, with ransomware gangs and cryptominers using them to stealthily perform malicious activity. However, threat actors commonly install these manually after they breach a network.
A new campaign spotted by Securonix researchers is instead using phishing emails to perform unattended installs of Linux virtual machines to breach and gain persistence on corporate networks.